Page 48
A critical buffer overflow vulnerability was discovered and patched in `src/core/hir.c`, where an unchecked `strcpy()` call allowed attacker-controlled input to overflow heap or stack buffers during source code processing. This class of vulnerability — catalogued as CWE-120 — is one of the oldest and most dangerous bugs in systems programming, and its presence in a compiler or language toolchain pipeline makes it especially severe. The fix eliminates the unsafe copy operation, closing a potentia
A critical stack buffer overflow vulnerability was discovered and patched in vzic-parse.c, where unbounded sprintf() calls constructed file paths from timezone data fields into fixed-size stack buffers without any length validation. An attacker supplying a malicious timezone data file could overflow the stack buffer, overwrite the return address, and achieve arbitrary code execution. This fix serves as a timely reminder of why safe string-handling functions are non-negotiable in C code.
A high-severity integer overflow vulnerability was discovered and fixed in `src/coredump/_UCD_create.c`, where arithmetic multiplication used to compute a memory allocation size lacked overflow protection. If the multiplication wrapped around, an undersized buffer would be allocated, opening the door to a heap overflow attack. This fix closes a subtle but dangerous code path that could lead to memory corruption and potential code execution.
A critical stack buffer overflow vulnerability was discovered and patched in tpl.c, where command-line arguments were copied into fixed-size stack buffers using strcpy without any length validation. An attacker supplying an oversized argument could overwrite the saved return address on the stack, achieving complete control flow hijacking. The fix eliminates this classic but devastatingly effective vulnerability class that has plagued C programs for decades.
A critical buffer overflow vulnerability was discovered and patched in RF24Network, a popular C++ library for mesh networking over nRF24L01 radio modules. Unvalidated attacker-controlled size values in `memcpy` calls allowed any nearby attacker to trigger memory corruption by transmitting malformed radio frames — no authentication required. This post breaks down how the vulnerability works, how it was fixed, and what developers can learn from it.
A high-severity command injection vulnerability (CWE-78) was discovered and patched in an nginx harness maintenance script that used `subprocess.check_output()` without proper input sanitization. Because maintenance scripts like this frequently run with elevated privileges, an attacker who could influence the input arguments could execute arbitrary system commands as root. This post breaks down how the vulnerability works, how it was fixed, and what you can do to prevent similar issues in your o
A critical buffer overflow vulnerability was discovered and patched in a shared C header file (common.h) used across an entire suite of games, where unbounded strcpy and strcat calls could allow attackers to overwrite stack memory and hijack program execution. The fix eliminates dangerous unbounded string operations, protecting every game binary that includes this shared header. Understanding this vulnerability is essential for any developer working with C/C++ string handling.
A critical heap buffer overflow vulnerability (CWE-120) was discovered and patched in `contrib/tzsp_forwarder.c`, where an attacker-controlled `caplen` value from a crafted network packet could overwrite adjacent heap memory structures. This class of vulnerability can lead to remote code execution, process crashes, or sensitive data disclosure. The fix introduces proper bounds validation before the dangerous `memcpy` operation, closing the door on this attack vector.
A medium-severity vulnerability was discovered and patched in `scapy/scapy_pcp.py`, where an unchecked `self.__dict__.update(entries)` call allowed attackers to inject arbitrary keys—including dangerous dunder attributes—directly into object namespaces via untrusted network packet data. Left unpatched, this flaw could enable object state corruption, method overwriting, and potential remote code execution in applications that parse attacker-controlled packets. The fix introduces proper key filter
A critical heap buffer overflow vulnerability was discovered and patched in the ndsrvp HAL filter routines, where multiple `memcpy` calls used computed sizes derived from image dimensions without validating they fit within destination buffers. An attacker supplying a crafted image could exploit this to corrupt heap memory, potentially achieving arbitrary code execution. This post breaks down how the vulnerability works, how it was fixed, and what developers can do to prevent similar issues.
A critical command injection vulnerability was discovered and patched in `drsolve_sage_interface.sage`, where unsanitized user-supplied polynomial expressions were passed directly to subprocess calls, potentially allowing attackers to execute arbitrary OS commands. This fix closes a dangerous attack vector that could have granted full system access to anyone able to submit crafted mathematical input. Understanding how this class of vulnerability works—and how to prevent it—is essential for any d
A critical command injection vulnerability was discovered and patched in Firejail's `netfilter.c`, where attacker-controlled environment variables could be used to inject shell metacharacters into a command string executed with elevated privileges. This type of vulnerability is particularly dangerous in security-focused tools like Firejail, which often run with root or elevated permissions, potentially allowing a local attacker to achieve full system compromise. The fix removes the unsafe `exec(